This involves creating a "secure" checkbox on the site form that will get passed to the backend so that the site gets HTTPS support (and only that). That's the first step in #394452: Full SSL support.

The vhost configuration would look something like this:

<VirtualHost *:80>
  DocumentRoot /var/aegir/drupal-5.18-aegir

  ServerName aegir.koumbit.net

  Redirect / https://aegir.koumbit.net/
</VirtualHost>

<VirtualHost *:443>
    SSLEngine On
    ServerAdmin webmaster@localhost
    ServerName aegir.koumbit.net

    DocumentRoot /var/aegir/drupal-5.18-aegir

   php_value session.cookie_secure 1
# Extra configuration from modules:

    # Error handler for Drupal > 4.6.7
    <Directory "/var/aegir/drupal-5.18-aegir/sites/default/files">
      SetHandler This_is_a_Drupal_security_line_do_not_remove
    </Directory>

</VirtualHost>

... so this will probably require another template. This is an otherwise pretty simple task: no certificate management and such.

This is just a matter of implementing a pre_task() hook in a new hosting_ssl module that will form_alter the site form and pass the 'ssl' flag in the backend. In provision, we should start a new provision_ssl module that will provide the new template, collect that ssl flag and override the site template if necessary, then write the ssl flag to the drushrc (see how aliases/redirection does it in #535098: domain redirection ).

Comments

anarcat’s picture

Issue tags: +aegir-ssl

tagging

anarcat’s picture

This will need to reuse some code from #535098: domain redirection. Maybe this depends on #541754: abstract away vhost engine?

anarcat’s picture

Status: Active » Needs work

This is now very close: we just need to add a SSLrequire or similar directive to the vhost now that the ports stuff has hit the tree. It already provides an "ssl" switch on the frontend.

anarcat’s picture

Status: Needs work » Fixed

I committed a first pass. You need to have the SSL certificates defined outside of the configuration file, but it works generally well. Once you choose port 443 (ssl), everything is automatic.

Here's the config I have in /etc/apache2/conf.d/aegir:

        SSLCertificateFile    /etc/ssl/certs/ssl-cert-snakeoil.pem
        SSLCertificateKeyFile /etc/ssl/private/ssl-cert-snakeoil.key

... which means everything is under the same certificate for now. The fix to that is #537016: simple certificate management.

It does *not* yet provide a http -> https redirection, which may be a problem, especially since the :80 vhost would then be up for grabs (not good: site_exists should check for more), but that's a frontend issue. Redirection can be completed once we have #541754: abstract away vhost engine.

I think our first milestone is crossed: we can create SSL vhosts.

anarcat’s picture

Here's the frontend issue with ports: #570980: allow vhosts of the same name on a different port.

Status: Fixed » Closed (fixed)
Issue tags: -aegir-ssl

Automatically closed -- issue fixed for 2 weeks with no activity.